Description

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0.  Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T10:16:59.477Z",
  "pubdate": "2026-08-07T10:16:59.477Z",
  "executiveSummary": "A Deserialization of Untrusted Data vulnerability exists in the Go implementation of Apache Fory, specifically impacting versions from 0.16.0 prior to 1.5.0. Users utilizing language implementations other than Go remain unaffected by this security flaw.\nThe vulnerability allows an unauthenticated remote attacker to induce a Denial of Service condition against systems processing untrusted serialized streams. By supplying meticulously crafted payload data containing malformed type metadata, the attacker can force the serialization runtime to encounter an unhandled exception state.\nThe primary risk implication is service availability disruption, as the triggered panic aborts the execution flow of the application handling the malformed input without graceful recovery mechanisms. No attacker privileges or complex authentication schemes are required for successful exploitation beyond the ability to transmit crafted input data to the vulnerable deserialization routines.\nRemediation requires upgrading the affected Go implementation of Apache Fory to version 1.5.0 or later, where the underlying type metadata parsing logic has been hardened to prevent uncaught runtime panics.",
  "technicalDetails": "The vulnerability resides within the Go implementation of the Apache Fory data serialization and deserialization framework, specifically affecting component versions ranging from 0.16.0 up to, but not including, 1.5.0. The root cause stems from insecure parsing of type metadata embedded within incoming serialized data streams.\nDuring the standard deserialization workflow, the Go library inspects and parses type metadata headers to reconstruct complex data structures. The parsing logic fails to adequately validate structural constraints and field boundaries when processing untrusted payloads. Consequently, when a malicious actor submits a crafted payload containing intentionally corrupted or structurally malformed type metadata, the internal parsing routines encounter unexpected states that they fail to handle safely.\nThis failure manifests as an uncaught runtime panic within the Go execution environment. Because the panic occurs without a corresponding recovery handler in the affected parsing code paths, the execution of the host goroutine or the entire application process is immediately terminated. This abrupt termination directly achieves a Denial of Service against the service or application relying on Apache Fory for inter-process communication, RPC, or data persistence handling.\nExploitation requires network exposure or a data ingestion vector where an attacker can supply malicious serialized payloads to the vulnerable deserialization endpoint. No prior authentication, specific user privileges, or interaction is necessary. The payload behavior is strictly destructive to service uptime, causing immediate availability loss upon ingestion and processing of the malformed metadata."
}